Critical severity · published Jan 26, 2024
CVE-2024-0921
D-Link DIR-816 A2 Web Interface setDeviceSettings os command injection
9.8
CVSS
37.6%
EPSS
No
On KEV
Description
A vulnerability has been found in D-Link DIR-816 A2 1.10CNB04 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/setDeviceSettings of the component Web Interface. The manipulation of the argument statuscheckpppoeuser leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252139.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)37.6% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
DIR-816 A2 · D-Link
1.10CNB04 · source: vendor, CISA
DA
Dir-816 A2 Firmware · Dlink
1.10cnb04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-0921
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-0921
Exploit
https://github.com/xiyuanhuaigu/cve/blob/main/rce.md
Permissions Required
https://vuldb.com/?ctiid.252139
Third Party Advisory
https://vuldb.com/?id.252139
More from DIR-816 A2
9.8
CVE-2023-43240
D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter sip_address in ipportFilter
9.8
CVE-2023-39637
D-Link DIR-816 A2 1.10 B05 was discovered to contain a command injection vulnerability via the component /goform/Diagnosis
5.3
CVE-2024-13108
D-Link DIR-816 A2 form2NetSniper.cgi access control
5.3
CVE-2024-13107
D-Link DIR-816 A2 ACL form2LocalAclEditcfg.cgi access control
5.3
CVE-2024-13106
D-Link DIR-816 A2 IP QoS form2IPQoSTcAdd access control